OK, so I need to replace all <, & and > plus all non-ascii characters with their html-entity counterparts. I've tried Underscore.string.escapeHTML but that didn't seem to touch the non-ascii chars.
For example I need this:
<div>föö bär</div>
converted into this:
<div>föö bär</div>
Obviously auml and ouml are not enough. I need a valid ascii string no matter what buttons the users chooses to push, or heaven forbit, even writes with some moonspeak keyboard.